Skip to main content

could_apply

agentd::sec::policy

Function could_apply 

Source 
pub fn could_apply(
    policies: &[Policy],
    tool: &str,
    tags: &[TrifectaTag],
    caller: PolicyCaller,
) -> bool
Expand description

Whether any rule could apply to this tool for this caller, ignoring the argument guard (which needs the actual call).

Used to decide which tools a turn worker must round-trip for. A child dials its MCP tools DIRECTLY from its route map and never reaches execute_tool, so a policy that covered root turns but not subagent turns would be worse than none: the operator would believe they were covered. Anything a rule might touch is moved out of the child’s route map and served by the runtime instead, so gated tools pay one round-trip and everything else keeps the fast path.